package-lock.json and deterministic installs in Node.js - Step-by-Step Execution

Concept Flow - package-lock.json and deterministic installs

Start: npm install

↓

Check package-lock.json

Yes↓

Use exact versions from package-lock.json

↓

Install dependencies exactly

↓

Update node_modules folder

↓

Finish: deterministic install

No↓

Create package-lock.json with resolved versions

↓

Install dependencies

↓

Finish: deterministic install

When running npm install, npm checks for package-lock.json to install exact versions, ensuring consistent installs across machines.

Execution Sample

Node.js

npm install
# Reads package-lock.json
# Installs exact versions
# Updates node_modules

This runs npm install, which uses package-lock.json to install exact dependency versions.

Execution Table

Step	Action	Check package-lock.json	Install Version	node_modules Update
1	Start npm install	Exists	Use versions from package-lock.json	Prepare node_modules
2	Resolve dependencies	Yes	Exact versions locked	Lock versions to install
3	Download packages	Yes	Exact versions	Add packages to node_modules
4	Finish install	Yes	All exact versions installed	node_modules ready
5	Run npm install again	Yes	Skip re-download if unchanged	node_modules unchanged
6	Delete package-lock.json	No	Resolve latest versions	node_modules updated with latest
7	Create new package-lock.json	No	Lock new versions	node_modules updated
8	Finish install	No	Versions may vary	node_modules ready

💡 npm install stops after installing all dependencies exactly as locked in package-lock.json or creates it if missing

Variable Tracker

Variable	Start	After Step 2	After Step 4	After Step 6	After Step 8
package-lock.json	Exists	Exists	Exists	Deleted	Created
Installed Versions	N/A	Exact locked	Exact locked	Latest resolved	Latest resolved
node_modules	Empty or outdated	Updating	Updated exact	Updating	Updated latest

Key Moments - 3 Insights

Why does npm install use exact versions from package-lock.json instead of package.json?

Because package-lock.json records the exact versions resolved, npm uses it to ensure everyone installs the same versions, as shown in execution_table rows 2 and 3.

What happens if package-lock.json is deleted before running npm install?

npm will resolve the latest versions allowed by package.json and create a new package-lock.json, as seen in execution_table rows 6 and 7.

Does npm install always download packages every time?

No, if package-lock.json and node_modules are unchanged, npm skips downloading, shown in execution_table row 5.

Visual Quiz - 3 Questions

Look at the execution_table, at which step does npm install skip re-downloading packages if nothing changed?

A Step 5

B Step 6

C Step 3

D Step 8

💡 Hint

Check the 'Install Version' and 'node_modules Update' columns at step 5 in execution_table

According to variable_tracker, what is the state of package-lock.json after step 6?

A Created

B Deleted

C Exists

D Empty

💡 Hint

Look at the 'package-lock.json' row under 'After Step 6' in variable_tracker

If package-lock.json is missing, what does npm install do according to execution_table?

A Installs exact locked versions

B Fails with error

C Resolves latest versions and creates package-lock.json

D Skips installation

💡 Hint

See steps 6 and 7 in execution_table for actions when package-lock.json is not found

Concept Snapshot

npm install uses package-lock.json to install exact dependency versions.
If package-lock.json is missing, npm resolves latest versions and creates it.
This ensures deterministic installs across machines.
Re-running npm install skips downloads if nothing changed.
package-lock.json locks versions for consistent builds.

Full Transcript

When you run npm install, npm first checks if package-lock.json exists. If it does, npm installs the exact versions recorded there, ensuring everyone gets the same dependencies. This updates the node_modules folder with those exact versions. If package-lock.json is missing, npm resolves the latest versions allowed by package.json, installs them, and creates a new package-lock.json to lock those versions. If you run npm install again without changes, npm skips downloading packages to save time. This process guarantees deterministic installs, meaning your project dependencies stay consistent across different machines and times.